System and Method for Data Acquisition in an Internet Protocol Network

1. A network monitoring system comprising: at least one network switch serving as an intermediary to i) at least one data input stream arriving on at least one port and ii) at least one data output stream, in a network; a capture server in communication with, and for capturing data from, the at least one network switch; and a data acquisition control engine that is configured to (i) receive a data acquisition instruction from a user, the instruction comprising a Voice over Internet Protocol (VOIP) equipment identification (ID) and a Virtual Local Area Network (VLAN) ID, (ii) based on the received data acquisition instruction, derive commands for the at least one network switch, including at least one port number that identifies the at least one port and that is based on the VOIP equipment ID and VLAN ID received, (iii) cause the received data acquisition instruction to be implemented on the at least one port at the at least one network switch according to the derived commands, and (iv) manage mapping between the at least one port number and specific devices in a manner that is opaque to the user.

2. The monitoring system of claim 1 wherein the commands derived by the data acquisition control engine include at least one command to mirror data from a first port of the at least one network switch to a second port, wherein the first port is identified by the at least one port number.

3. The monitoring system of claim 2 wherein the data mirrored to the second port is directed to the capture server.

4. The monitoring system of claim 2 wherein the command to mirror includes a command to mirror data according to a defined schedule.

5. The monitoring system of claim 2 wherein the command to mirror data includes a command to start mirroring data in response to an occurrence of a specific event.

6. The monitoring system of claim 1 wherein the data acquisition control engine includes data that maps ports on the at least one network switch according to at least one of: (a) The type of data traffic flowing through each port; (b) A device type that data on a given port originates from; and (c) An identification of a specific device that data on a given port originates from.

7. A method comprising: presenting a graphical user interface (GUI) to a user by a data acquisition control engine in a network such that the GUI conceals, from the user, mappings of at least one port number to particular devices; receiving, by the GUI presented by the data acquisition control engine, a data acquisition instruction from the user, wherein the data acquisition instruction specifies a data acquisition plan that comprises a Voice over Internet Protocol (VOIP) equipment identification (ID) and a Virtual Local Area Network (VLAN) ID; deriving, by the data acquisition control engine, commands to issue to one or more network switches in the network, including the at least one port number, wherein the at least one port number identifies at least one port and is based on the VOIP equipment ID and VLAN ID received, wherein the commands are based on the data acquisition plan, and wherein each of the one or more network switches serves as an intermediary to i) at least one data input stream arriving on the at least one port and ii) at least one data output stream; and transmitting, by the data acquisition control engine, the derived commands to the one or more network switches, wherein the transmitting of the derived commands causes the data acquisition plan to be implemented on the at least one port at the one or more network switches.

8. The method of claim 7 further comprising: mirroring data from at least one data source port to at least one destination port in response to the transmitted commands, wherein the at least one data source port is identified by the at least one port number.

9. The method of claim 8 further comprising: transmitting the mirrored data to a capture server in the network.

10. The method of claim 9 further comprising: storing the transmitted data by the capture server.

11. The method of claim 10 further comprising: associating the stored data with the specified data acquisition plan and with the user who submitted the data acquisition plan, in a database accessible to the capture server.

12. The method of claim 9 wherein the mirroring step comprises: obtaining data from a specific port of a specific network switch in accordance with the data acquisition plan.

13. The method of claim 9 wherein the mirroring step comprises: obtaining data from a specific device within the network in accordance with the data acquisition plan.

14. The method of claim 9 wherein the mirroring step comprises: acquiring data over a time period having start and end times specified in the data acquisition plan.

15. The method of claim 9 wherein the mirroring step comprises: starting to acquire data based on the occurrence of a particular event specified in the data acquisition plan.

16. A data acquisition control engine for monitoring a network, comprising: a database to store data describing network elements within the network and links interconnecting the network elements; a graphical user interface (GUI) configured to receive information from a user specifying one or more data acquisition operations for the network, the received information comprising a Voice over Internet Protocol (VOIP) equipment identification (ID) and a Virtual Local Area Network (VLAN) ID; a processor configured to access the database and to transmit a data acquisition instruction corresponding to a specified data acquisition operation specified in the database; and a first network link for connecting the data acquisition control engine to a network element of the network elements, and configured to convey the data acquisition instruction to the network element, wherein the data acquisition instruction instructs the network element to mirror data arriving on a port at the network element, wherein the identification number of the port is based on the VOIP equipment ID and VLAN ID received, and wherein mapping of the identification number of the port to a particular device is concealed from the user.

17. The data acquisition control engine of claim 16 further comprising: a second network link for connecting the data acquisition control engine to a capture server, and configured to convey the data acquisition instruction to a capture engine.

18. The data acquisition control engine of claim 16 wherein the processor is configured to transmit the data acquisition instruction in response to manual input to the GUI from a user.

19. The data acquisition control engine of claim 16 wherein the database is configured to store schedules for conducting data acquisition operations.

20. The data acquisition control engine of claim 19 wherein the processor is configured to transmit the data acquisition instruction to the capture server in accordance with the schedules stored in the database.

21. The data acquisition control engine of claim 16 wherein the processor is configured to initiate a data acquisition operation upon detecting an occurrence of a pre-defined condition.

22. The data acquisition control engine of claim 16 wherein the processor is configured to halt a data acquisition operation based on the occurrence of a pre-defined condition.

23. The data acquisition control engine of claim 16 wherein the processor is configured to halt a data acquisition operation based on the occurrence of an overload condition in the network.